From: dongshengyuan <545258830@qq.com>
Date: Fri, 17 Jul 2026 07:55:57 +0000 (+0800)
Subject: machined: refresh resolve hook addresses per machine
X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=8a5c8b751b93c71893e11d29538d7fb410f2a8b8;p=thirdparty%2Fsystemd.git

machined: refresh resolve hook addresses per machine

Track which machine the cached address list belongs to and refresh it
when ResolveRecord() advances to another machine. This keeps A/AAAA
reuse for the same machine while avoiding mixed name/address records.

Reproducer: register two machines with private addresses 10.88.1.1
and 10.88.2.1, then call io.systemd.Resolve.Hook.ResolveRecord
with both A questions in one request.

Before: the answer for the second machine used its own name but
reused the first machine's address, e.g. resolve-bug-m2 returned
10.88.1.1 instead of 10.88.2.1.

Follow-up: 3cd929f837854e96cd0a856f9a96518701841782
---

diff --git a/src/machine/machined-resolve-hook.c b/src/machine/machined-resolve-hook.c
index 1d1a9ad0a93..8c5c81b29ba 100644
--- a/src/machine/machined-resolve-hook.c
+++ b/src/machine/machined-resolve-hook.c
@@ -125,6 +125,7 @@ int vl_method_resolve_record(
         _cleanup_(dns_answer_unrefp) DnsAnswer *answer = NULL;
 
         _cleanup_free_ struct local_address *addresses = NULL;
+        Machine *addresses_machine = NULL;
         bool found = false, nxdomain = false;
         int n_addresses = -1;
 
@@ -138,10 +139,13 @@ int vl_method_resolve_record(
                         if (!dns_resource_key_is_address(key))
                                 continue;
 
-                        if (n_addresses < 0) {
+                        if (addresses_machine != machine) {
+                                addresses = mfree(addresses);
                                 n_addresses = machine_get_addresses(machine, &addresses);
                                 if (n_addresses < 0)
                                         return n_addresses;
+
+                                addresses_machine = machine;
                         }
 
                         int family = dns_type_to_af(key->type);
diff --git a/test/units/TEST-13-NSPAWN.nss-mymachines.sh b/test/units/TEST-13-NSPAWN.nss-mymachines.sh
index e4a96167128..2468227c06b 100755
--- a/test/units/TEST-13-NSPAWN.nss-mymachines.sh
+++ b/test/units/TEST-13-NSPAWN.nss-mymachines.sh
@@ -148,4 +148,10 @@ for i in {100..120}; do
     run_and_grep "10\.2\.0\.$i" resolvectl query nss-mymachines-manyips
 done
 
+hook_question='{"question":[{"key":{"class":1,"type":1,"name":"nss-mymachines-singleip"}},{"key":{"class":1,"type":1,"name":"nss-mymachines-manyips"}}]}'
+hook_answer="$(varlinkctl --json=short call /run/systemd/resolve.hook/io.systemd.Machine io.systemd.Resolve.Hook.ResolveRecord "$hook_question")"
+jq -e '.answer[] | select(.rr.key.name == "nss-mymachines-singleip" and .rr.address == [10, 1, 0, 2])' <<<"$hook_answer"
+jq -e '.answer[] | select(.rr.key.name == "nss-mymachines-manyips" and .rr.address == [10, 2, 0, 2])' <<<"$hook_answer"
+(! jq -e '.answer[] | select(.rr.key.name == "nss-mymachines-manyips" and .rr.address == [10, 1, 0, 2])' <<<"$hook_answer")
+
 machinectl stop nss-mymachines-{noip,singleip,manyips}